BIT-openbao-2025-4166

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2025-4166.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-openbao-2025-4166

Aliases

Published

2026-07-27T05:48:46.909Z

Modified

2026-07-27T09:11:29.300565599Z

Summary

Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

Details

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Database specific

{
    "cpes": [
        "cpe:2.3:a:openbao:openbao:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / openbao

Package

Name: openbao
Purl: pkg:bitnami/openbao

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2025-4166.json"